Falhas do tipo CWE-79

29.224 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-1143CRITICALCentral Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and sEPSS 0.5%CVE-2023-7225MEDIUMMapPress <= 2.88.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map SettingsEPSS 0.5%CVE-2023-7135LOWcode-projects Record Management System Offices offices.php cross site scriptingEPSS 0.5%CVE-2022-40841MEDIUMA cross-site scripting (XSS) vulnerability in NdkAdvancedCustomizationFields v3.5.0 allows attackers to execute arbitrary web scripts or HTMEPSS 0.5%CVE-2023-23326MEDIUMA Stored Cross-Site Scripting (XSS) vulnerability exists in AvantFAX 3.3.7. An authenticated low privilege user can inject arbitrary JavascrEPSS 0.5%CVE-2023-6075LOWPHPGurukul Restaurant Table Booking System Reservation Request index.php cross site scriptingEPSS 0.5%CVE-2023-7136LOWcode-projects Record Management System Document Type doctype.php cross site scriptingEPSS 0.5%CVE-2023-4983MEDIUMapp1pro Shopicial search cross site scriptingEPSS 0.5%CVE-2022-36057MEDIUMDiscourse-Chat Cross-Site Scripting issue for channel names and descriptionsEPSS 0.5%CVE-2024-30883MEDIUMReflected Cross Site Scripting (XSS) vulnerability in RageFrame2 v2.6.43, allows remote attackers to execute arbitrary web scripts or HTML aEPSS 0.5%CVE-2024-7929MEDIUMSourceCodester Simple Forum Website Signup Page registration.php cross site scriptingEPSS 0.5%CVE-2026-35198CRITICALHeyForm vulnerable to stored XSS via form field titlesEPSS 0.5%CVE-2026-45343HIGHLinkAce - Stored XSS via Unsanitized SSO User's Name Rendered in Admin Audit Log Allows Session HijackingEPSS 0.5%CVE-2023-6098MEDIUMCross-site Scripting on ICSSolution ICS Business ManagerEPSS 0.5%CVE-2024-7649MEDIUMOpal Membership <= 1.2.4 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-27734MEDIUMA Cross Site Scripting vulnerability in CSZ CMS v.1.3.0 allows an attacker to execute arbitrary code via a crafted script to the Site Name fEPSS 0.5%CVE-2022-39373MEDIUMStored Cross-Site Scripting (XSS) in entity name in GLPIEPSS 0.5%CVE-2023-3672HIGHCross-site Scripting (XSS) - DOM in plaidweb/webmention.jsEPSS 0.5%CVE-2022-3516MEDIUMCross-site Scripting (XSS) - Stored in librenms/librenmsEPSS 0.5%CVE-2025-46729LOWphpDVDProfiler Cross-site Scripting vulnerabilityEPSS 0.5%